Unable to login to account, lost access to 2FA email

Question

Hello,

I'm posting this on my personal bitbucket account because I'm unable to login with credentials tied to an email address domain that was used to create a bitbucket account for a website project for the small business I work(ed) for. When I created the account long ago 2FA was not common or even prompted. The business I worked for was then bought out by a larger company, but the old website and email remained so I left the account tied to that email address. Since then the IT department integrated us into their systems and emails were being forwarded from the old domain to the new domain. It appears they stopped doing this in recent weeks.

I just logged into this bitbucket account last week and didn't require 2FA to my email. I either enabled it by accident or it is now required. But the email is never delivered. And now I'm stuck with my project sitting in an account that nobody can access.

However, I have VSCode still configured with the Atlassian plugin and it appears it still has access to the git repo through this account. I'm sure the OAuth is going to expire at some point though and then I'll be entirely locked out with no way to login.

Is there a way to disable the 2FA? Get recovery keys? Support maybe provide some help? It would be nice to get back into the account and update the email address to the proper new company email address.

EDIT: Also, I have SSH keys that still work, however the "ssh git@bitbucket.org recovery_codes" command I saw referenced from previous years doesn't seem to do anything for me. I get a response of "authenticated via ssh key. You can use git to connect to Bitbucket. Shell access is disabled".

Theodora Boudale · Answer

Hi Jason,

I'm afraid that we cannot disable 2FA on Atlassian or Bitbucket accounts. If 2FA is enabled on either of the two, access to the account's email address is needed in order to disable it.

Kind regards,
Theodora

Jason Gould_937nhx · Answer

So there is literally no way for me to push a file to the repo or anything to prove my ownership and have the 2FA disabled? The 2FA that wasn't turned on the start of November when I logged in without it? I still have no idea why it was enabled to begin with.

I was the IT person for the company and controlled the domain until we integrated our IT infrastructure (they are a massive company). While I can try, I have a feeling they aren't going to publish the DNS records necessary to get the email flowing again. Mostly because they weren't properly filtering it and spam was out of control.

Theodora Boudale · Answer

Hi Jason,

Recovery codes cannot be retrieved by SSH anymore. If you don't have any recovery codes or an authenticator app that provides you codes, then you'll need to access to the account's primary email address in order to disable 2FA.

Bitbucket Cloud uses Atlassian accounts for authentication and 2FA can be set up on the Bitbucket account, the Atlassian account, or both. The following knowledge base article explains the difference and provides instructions on how to disable both:

* https://confluence.atlassian.com/bbkb/how-to-disable-reset-2fa-on-bitbucket-cloud-and-atlassian-account-1236932929.html

In order to do that, you'll need to ask your IT department to enable the email account associated with the Bitbucket account.

Kind regards,
Theodora